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Abstract. In this paper, we consider continuous-variable quantum key distribution 
with a discrete modulation, either binary or quaternary. We establish the security of 
these protocols against the class of collective attacks that induce a linear quantum 
channel. In particular, all Gaussian attacks are taken into account, as well as linear 
attacks which add a non-Gaussian noise. We give lower bounds for the secret key rate 
using extremality properties of Gaussian states. 
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1. Introduction 

Quantum Key Distribution (QKD) appears to be the first real-world application of 
the fastly growing field of quantum information theory (Tj. QKD protocols aim at 
distributing a secret key among distant parties, Alice and Bob, in such a way that an 
eavesdropper, Eve, cannot learn anything about the key except with an arbitrary small 
probability e. Since the proposal of the first QKD protocol in 1984 [2], most schemes 
have considered encoding information on two-level systems, such as the polarization 
of a single photon. In such schemes Bob would recover this information with photon 
counting techniques. 

More recently, homodyne detection has been proposed to replace single photon 
counters. The main advantages of homodyne detection are its higher quantum efficiency 
and its greater technological maturity, both being consequences of the fact that 
homodyne detection is implemented with PIN photodetectors which are commonly 
used by the telecom industry. This is in sharp contrast with single photon detectors 
which are almost specific to QKD. In protocols relying on homodyne detection, which 
we refer to in the following as continuous-variable (CV) protocols by opposition to 
discrete-variable (DV) protocols, one must encode the information differently than in 
DV protocols: phase space replaces the traditional Bloch sphere describing the qubits 
used in BB84 for instance. The first CV QKD protocols were exploiting phase space as 
efficiently as possible by using coherent states with a Gaussian modulation [3] which is 
the modulation maximizing the mutual (classical) information between the input and 
the output of an Additive White Gaussian Noise (AWGN) channel. Such a channel 
models accurately the effect of typical optical fibers on the quadratures of the EM field. 
Using theorems about the optimality of Gaussian attacks, such schemes were proven 
secure against collective attacks [U EJ |6] then later against general attacks [7] and were 
also successfully implemented (HI E] . 

In order to reach significant transmission distances (with more than 3 dB losses), 
two different techniques have been proposed : reverse reconciliation where the key 
elements are a function of Bob's measurement results [TQl E] and post-selection where 
Alice and Bob discard the data for which Eve has learnt too much information [12J. 
However, the analysis of post-selected schemes is quite involved their security has been 
established only against the restricted class of Gaussian attacks [13J. In this paper, we 
consider protocols with a reverse reconciliation but without post-selection. 

In practice, CV QKD has many advantages on the implementation point of view, 
but up until now, it seemed restricted to smaller distances than photon-counting QKD, 
and for instance it was unable to distribute secret keys over more than 50 km. The 
reason for this comes from the difficulty to correct the errors between Alice and Bob's 
data induced by the quantum channel. If this is not a problem in principle as one 
only needs to approach the Shannon capacity of a AWGN channel, it turned out to be 
quite difficult to realize in practice for a Gaussian modulation [T4] . For this reason, 
using a discrete modulation instead of a continuous Gaussian modulation appeared as 



Continuous-variable Quantum Key Distribution protocols with a discrete modulation 3 

a possible solution as it greatly simplifies the error correction step. However, switching 
from a continuous to a discrete modulation opens new theoretical questions as the proof 
techniques used in jH El |6] do not apply anymore. One therefore needs to develop a 
new approach to prove the security of CV QKD protocols with a discrete modulation. 
This was recently done in JT5] for a protocol with a quaternary modulation. The new 
technique allows one to establish the security of the protocol when the quantum channel 
is linear. In particular, the noise added by the channel can be either Gaussian or non- 
Gaussian. Moreover, one advantage of the proof is that it only requires to estimate 
two experimental parameters, namaely the transmission T and excess noise £ of the 
quantum channel. Note that several protocols with a discrete modulation had been 
studied before [15J, but their security was only established against Gaussian attacks 
[IE1 EES UHl UHl [SOI 121] ■ In this paper, we review more in depth the proof of [To] , and 
apply it to analyze a protocol with a binary modulation, considering either homodyne 
or heterodyne detection schemes. 

The outline of the paper is the following. In Section [2j we describe CV QKD 
protocols with a discrete modulation and we insist particularly on two instances of such 
protocols for which good error correction schemes are known: the four-state protocol 
first recently introduced in [15] as well as a two-state protocol quite similar to the 
protocol considered in [22J . Then, in Section [3j we present the general outline of the 
security proofs of such protocols. We proceed with giving an explicit security proof for 
each of them, respectively in Sections [4] and |5j In Section [6j we present the secret key 
rate of the prootocols and conclude with their expected performances in Section [7] for 
realistic, state of the art implementations. In the Appendix, we give some details about 
the specific reconciliation procedure involved in these protocols. 

2. CV QKD protocols with a discrete modulation 

In the following, we consider two CV QKD protocols with a discrete modulation 
involving respectively two and four coherent states. The four-state protocol was 
introduced in [T5]. The two-state protocol is a new protocol which shares similarities 
with the protocol presented in [22] but displays a different choice of measurement for 
Bob. Both modulation schemes are displayed on Figure [T] 

In any such protocol, Alice sends n random coherent states drawn from either 
<S 2 = {|ae"^/ 4 ), |ae 3 ^/ 4 )} or <S 4 = {|ae i7r / 4 ), |ae 3 ^/ 4 ), |ae 5i7r / 4 ), |ae 7 ^/ 4 )} where a is 
chosen to be a positive real number. Then, for each state, Bob performs an homodyne 
measurement on a random quadrature x or p. Note that in the case of the two-state 
protocol, Bob's measurement is not the optimal measurement to distinguish between 
the state \ae~ m l 4 ) and | — ae~ ln ^). For both protocols, Bob obtains the real random 
variable for % e {1, • • • , n}. Alice and Bob use a reverse reconciliation, and the sign hi 
of Hi encodes the raw key bit: we note 6j = 1 if yi > and 6j = if y^ < 0. Alice must 
then recover the value of the string b = (pi, ■ ■ ■ , b n ). To help her, Bob sends some side- 
information consisting of the quadrature measured, x or p, the absolute value of for 
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Figure 1. (Color online.) Encoding schemes used for the two-state protocol (left) 
and the four-state protocol (right). 

% G {1, • • • , n} as well as the syndrome of b for a linear error correcting code Alice and 
Bob agreed on beforehand. Alice then proceeds by decoding her word x = {x±, ■ ■ ■ , x n } 
where Xi corresponds to the sign of the quadrature Bob measured for the state she 
sent. An alternative protocol for the four-state protocol consists for Bob to perform 
an heterodyne (instead of homodyne) measurement [23| 124"]. In this case, he measures 
both quadratures, and obtains two measurement results and yf for each state sent 
by Alice. The raw key now consists of both signs of yf and yf. 

As usual in all QKD schemes, a supplementary step has to be added for channel 
estimation: Alice and Bob reveal a fraction of their data and compute the covariance 
matrix of the state pab that they would share in an entanglement-based version of the 
protocol [25] • This allows them to compute an upper bound on Eve's information on y, 
the Holevo information S(y; E). If the error correcting code used by Alice and Bob has 
a rate R, the secret key rate against collective attacks (in the limit where the fraction 
of data revealed for parameter estimation becomes negligible) reads: 

K = R-S(y;E). (1) 

R is upper bounded by the mutual information I(x; y) between Alice and Bob and one 
can therefore introduce the reconciliation efficiency (5 defined as /3 = R/I(x;y). One 
then finds the more common expression for the secret key rate: 

K = f3I(x-y)-S(y-E). (2) 

With this expression, it is clear that being able to perform an efficient reconciliation, 
with (3 close enough to 1, is crucial. Unfortunately, for a Gaussian modulation, the best 
reconciliation schemes j26j E] presently known see their efficiency drop under 50% at 
low signal to noise ratios (SNR). This is rather dramatic in terms of the range of the 
protocol as one needs to work at low SNR to distribute secret over long distances. A 
hand waving argument for this fact is given now. It is known [27J |28] that the quantity 
Kperf = y) — S(y; E) tends to a finite limit as the modulation variance Va of Alice 
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tends to infinity. However, both quantities I(x; y) and S(y; E) diverge to infinity. As 
a consequence, the penalty (1 — 0)I{x\y) imposed by an imperfect reconciliation also 
goes to infinity for any value of (3 stricly less than 1. Therefore, one should not work 
with a large modulation variance as soon as the reconciliation is not perfect, which is 
never the case. On the contrary, for a realistic reconciliation efficiency (around 80%), 
the optimal modulation variance is typically quite low (less than 10 photons per pulse 
on average). Associated with high loss channels, i.e. long distance, the SNR is finally 
very low, well below 1 and reconciliation schemes for Gaussian modulation fail, meaning 
that no secret key can be exchanged over long distances with such a scheme. 

An appealing alternative appears with discrete modulation schemes. The reason 
for this is that good reconciliation procedures can be found, even at very low SNR, for 
some modulation schemes. More precisely, in the case of the BI-AWGN channel (where 
Alice uses a binary modulation ±a on an AWGN channel), good error correction codes 
are known at very low SNR [15]. Such a binary modulation scheme for error correction 
can be implemented either with a two-state protocol with coherent states in S 2 or a 
four-state protocol with coherent states in 1S4. In particular, the error correcting codes 
presented in [TJ] allow one to get a reconciliation efficiency of 80% for arbitrary low 
SNR. The main drawback of such protocols is that the methods used to upper bound 
S(y; E) in the protocol using a Gaussian modulation [U 151 [S] cannot be directly applied 
in the case of a discrete modulation scheme. One then needs to come up with a security 
proof specific to such protocols. We address this question in the next section. 

In the remaining of the document, we use the notation 7 = ae 7m ^ A = ae" CT ' 4 so 
that the set S 2 of coherent states used in the two-state protocol is {(7), | — 7)}. 

3. General outline of the security proofs 

The security of the various protocols we consider here is studied through entanglement- 
based versions of the protocols. In the prepare and measure version of the protocols 
that are used in practice, Alice randomly draws n binary or quaternary variables, each 
corresponding to a specific coherent state of S 2 for the two-state protocol or of 1S4 in 
the case of the four-state protocol. Alice then prepares these n coherent states and 
sends them to Bob through the quantum channel. In the entanglement-based version 
of the protocol, Alice starts with a pure bipartite state ($2) (or ($4), depending on 
the protocol) and performs a projective measurement on the first half of this state. 
The second half is sent to Bob through the quantum channel. For instance, in the 
protocol with a Gaussian modulation [3], the initial bipartite state is a two-mode 
squeezed vacuum, and the projective measurement performed by Alice is an heterodyne 
measurement, which projects the second half of the state on a coherent state [25]. The 
covariance matrix r TMS of the two-mode squeezed vacuum reads 




(3) 
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where a z = \ ^ ^ j and Z G = 2-\/a 4 + a 2 . Rewriting r TMS with a direct reference 
to Alice's modulation variance Va in the prepare and measure protocol, one has: 

(4) 



TMS 



G 



(5) 



(V A + 1)1 2 Z G a z 
Z G Gz (Va + 1)1 2 

As the second half of the state is sent through a quantum channel characterized by its 
transmission T and excess noise £, one can write the covariance matrix Tq of the state 
Pab Alice and Bob share in the CV QKD protocol with a Gaussian modulation: 

(V A + l)t 2 VTZ G a z 
VfZ G a z (TV A + l + n)l 2 

Then the Holevo information between Eve and Bob's measurement result can be upper 
bounded by a function of To [5] . Note indeed that the argumentation in [5j does no rely 
on the fact that the state considered is indeed Gaussian: only the covariance matrix 
of the states matters. This is not the case in |4] and [B] where the proof technique 
explicitely requires the modulation to be Gaussian. 

For the protocols of interest in this article, the goal is to apply the same type 
of proof technique. We therefore want to find a purification |$ 2 ) (resp. ($4)) with a 
covariance matrix T 2 (resp. T 4 ) as close as possible as the one of a two-mode squeezed 
state. This covariance matrix has the following form: 



2,4 




(6) 



Z 2 a 0~ z 

(Va + 1)1 2 

and the goal is to find a bipartite state |<3> 2 ) (resp. ($4)) such that Z 2 (resp. Z±) is as 
close as possible of Z G . Of course, in order to be a legitimate entanglement-based version 
of the protocol, the bipartite initial state must be such that there exists a projective 
measurement that Alice can perform that projects the second half of the state onto the 
desired 2 (or 4) coherent states of the set S 2 (or S4). Also, it is worth emphasizing 
that, while the security proof of the Gaussian protocol is based on (virtual) Gaussian 
entanglement, the present proof is based on (virtual) non-Gaussian entanglement, which 
appears in this context as a convenient theoretical tool. 

Now, the main idea of the discrete modulation protocols we study here is that there 
exists a regime for the modulation variance, Va, such that 

I 2 (x;y) « h(x;y) » I G (x;y), , 
S 2 {y-E) « S 4 (y;E)^S G (y;E) { > 

but with (3 2 /3 4 3> {3 G . Here, the various subscripts 2,4, G refer to the different 
protocols: the binary modulation, the quaternary modulation and the Gaussian 
modulation. The existence of this regime allows one to have K 2 , K4 > for distances 
where the secret key rate for a Gaussian modulation K G is null. 

The next two sections are concerned with the study of such states |$ 2 ) and|$ 4 ) and 
computing the correlation terms Z 2 and Z 4 of their covariance matrices. 
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4. Two-state protocol 

We introduce a new QKD protocol involving two coherent state {|ae~ l7r//4 ), | — ae _i7r / 4 )} 
where the detection is an homodyne measurement on a randomly chosen quadrature x 
or p. This protocol is quite similar to the protocol studied in |22j but the difference 
between the two protocols is that in [22], the two coherent states are modulated along 
one of the quadratures measured by Bob. This is not the case here. The security analysis 
follows the same lines as for the recently introduced four-state protocol [15J. 

In the prepare and measure version of the protocol, Alice sends the coherent states 
{I7) and I — 7)} with probability 1/2 to Bob. Hence Bob sees a mixture p<i given by: 

P2 = ^(|7><7i + i-7><-7l) (8) 

= H0o)(0o| (9) 

where /x — e ~ a2 cosh a 2 , \i\ = e~" 2 sinh a 2 and 

1 00 f_,-y«n/ 2n + 1 

w ^OTS""" /4 7CT |2n+1> - 

In order to use the proof technique described in the previous section, we need to 
consider the entanglement based version on the protocol. In this version, Alice starts 
with a bipartite non-Gaussian pure state \&2)- She performs a projective measurement 
on one half of the state and sends the other half to Bob through the quantum channel. 
Depending on the binary result of her measurement, the state sent to Bob is either I7) 
or I — 7) with equal probabilities. Let us consider the following purification for p: 

l$ 2 > = yfM<l>l)\fo) + vWDI^i) (12) 
where |0*>) and are simply defined as: 

I^^E^^I^), (14) 
where we recall that a is a positive number. can a lso be rewritten as: 

|$ 2 > = -L|^>| 7 ) + i^ 1 >|-7> (15) 

with 

' IV*> = ^(I0o) + I0i» 

l^l) = ^(I0o)-I0l)) 

At this point, it is worth noting that in the entanglement based version of the 
protocol, Alice simply applies the projective measurement {|'0o)('0o|) IV'iKV'iI} to the 



(16) 
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first half of the state \Q 2 ) and that she therefore projects the second half either on the 
coherent state I7) or the coherent state | — 7) with equal probabilities. The Wigner 
functions of the orthogonal non-Gaussian states \ipo) and \ipi) corresponding to Alice's 
projective measurement are displayed on Figure [2j Note that |^o) is peaked close to the 
coherent state \ae m / 4 ) while is peaked close to \ae 5l7T ^). 




Figure 2. (Color online.) Wigner functions of the states | "0o) (left) and \tpi) (right) 
of the two-state protocol for a 2 = 0.01 unit of shot noise. 

We now proceed with evaluating the covariance matrix T 2 of \Q 2 )- Straightforward 
algebraic manipulations show that it has the following form: 

Xt 2 Z 2 a z 
^Z 2 a z Yl 2 

with 



(17) 




($ 2 |2ata+ 1|$ 2 ) 

($ 2 |26tfe + l|$ 2 ) (18) 

where a, and b, are respectively the annihilation and creation operators on Alice 
and Bob's modes of the state. 

In order to compute X, one can consider the state pa=\ (|t*)(t*| + I ~ 7*)( — 7*1) 
obtained by tracing over the second subsystem of |$2) : 

X = (® 2 \2a*a + 1|$ 2 > 
= tr(2a^a + 1)pa 

= 1 + tr(a f a|7)(7|) + tr(a f a| - 7X-7I) 
= 1 + 2a 2 

since a| ± 7) = ±7 | ± 7). The symmetry of the state \Q 2 ) shows that 

Y = ($ 2 |2& t 6+ 1|$ 2 > = X. 
One easily notes that 



(19) 
(20) 
(21) 
(22) 



a|0 o ) 



-1a 




1) 



(23) 
(24) 
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a\<f>i) = ioiJ — |0o)- (25) 
V A*i 

Hence, applying the operator ab on the state |$ 2 ) gives: 

ab\^) = o? f^|^)|0o) + (26) 
V v Z^ 1 V / 



and: 



and finally 



3/2 3/2 \ -. _ 4q ,2 

(W _ M ^ + ^u a2 _^_ (27) 



($ 2 |Z 2 |$ 2 ) = ($ 2 |a6 + aW^a) (28) 
= 2fte($ 2 |a&|$ 2 ) (29) 

i , -4a 2 

(30) 

The quantity Z 2 is displayed on Figure |4| For a variance of modulation less than 
0.05, that is a ;$ 0.15, Z 2 is almost indistinguishable from Z G thus suggesting that in 
this regime, S^y; -E) ~ Sg{u] E). This behaviour will be confirmed in Section [7j 

5. Four-state protocol 

In this section, we study the protocol recently introduced in [TS]. More specifically, we 
introduce a non-Gaussian state ($4) that can be used in an entanglement-based version 
of the protocol and for which we compute the covariance matrix. 

In the prepare and measure version of the protocol, Alice sends the coherent states 
{I7), I7*), I — 7) and I — 7*)} with probability 1/4 to Bob. Hence Bob sees a mixture 
given by: 

P4 = \ (|7><7l + l7*)<7*l + I - 7)<-7l + I - 7*}<-7*l) (31) 
= A o |0o)(0o| + Ai|0i)(0i| + A 2 |0 2 )(0 2 | + A 3 |0 3 )(0 3 |, (32) 



where 



and 



V2 = 2 e a (cosh(a 2 ) ± cos(a 2 )) 
Ai j3 = \e~ a (sinh(a 2 ) ± sin(a 2 )) 



(33) 



a 2 /2 ™ An +k 

VT k ^ V(4n + fc)! 

for k G {0,1,2,3}. 

Applying the annihilation operator a to \(f>k) gives: 

a\(f) k ) = (35) 
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for k G {1,2,3} and 



a|0o) = -a—=\(j>3). 
V 



Let us now introduce the following purification |<3> 4 ) of the state p 4 : 



|$ 4 > = v^fcl^fc)!^)- 



k=0 



This state can also be written as: 

l*4> = l (|-0o>lT*> + - 7) + |^>l - 7*) + |V^>|7» 



where the states 



+2fc)m7r/4 



|0m) 



(36) 



(37) 



(38) 



(39) 



m=0 



are orthogonal non-Gaussian states. These states are displayed on Figure [3] 




Figure 3. (Color online.) Wigner functions of the states IV'o), l^i), IV^) and \ip3) for 
a 2 = 0.5 unit of shot noise. 



In the entanglement-based version of the protocol, Alice needs to perform 
a projective measurement having these states as eigenstates, in order to project 
the second half of |$ 4 ) on one of the four coherent states of iS 4 , namely 

{\^ )MA^i)MA^)M,M(M- 
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Let us compute the covariance matrix r 4 of the bipartite state ($4). One can show 
that T 4 has the following form: 



Xt 2 Z^a z 
Z 4 a z Yl 2 



(40) 



where 



X = Y = ($ 4 |1 + 2a t a|$ 4 ) = ($ 4 |1 + 26 t 6|$ 4 ) (41) 

= tr(l + 2a)a p 4 ) (42) 

3 

= tr(l + 2^a t aA fc |0 fc )(0 fc |) (43) 

k=0 

3 

= l + 2^A fc (0 fc |a t a|0 fc ) (44) 

fc=0 

= l + 2a 2 VA^ (45) 

fc=0 ft 

= 1 + 2a 2 . (46) 
We are now interested in the correlation term of the covariance matrix, that is 

($ 4 |Z 4 |$ 4 ) = ($ 4 |a6 + a t 6 t |$ 4 ) (47) 
= 2fte($ 4 |a6|$ 4 ). (48) 



One has: 



a 2 



b\^)=abJ2V^k\h)\^k) (49) 

k=0 

3 A 

y;^v^k-i)i&-i) (50) 
Afc 

where addition should be understood modulo 4. Finally, we obtain: 

3 ,3/2 

($ 4 |Z 4 |$ 4 )=2a 2 ^-^. (51) 

The behaviour of Z 4 is plotted on Figure [ij For Va ~ 0.5, that is a ;$ 0.5, Z 4 and Zg 
are almost indistinguishable, meaning that in this regime, one has S±(y; E) m Sa(y; E). 
We confirm this intuition in the next section. 



6. Secret key rate of the protocols 

For both protocols, the Holevo information between Eve and Bob's measurement result 
is upper bounded by the same quantity computed for a Gaussian state p ( \ B with the 
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Figure 4. (Color online.) Comparison of the correlation Z2 for the two-state protocol 
(lower curve), Z4 for the four-state protocol (middle curve) and for the Gaussian 
modulation protocol Zq (upper curve) as a function of the modulation variance 
V A = 2a 2 . 




same covariance matrix as the state pab shared by Alice and Bob in an entanglement- 
based version of the protocol. Hence one can give a lower bound for both secret key 
rates K 2 and 

Ph(x;y) - S 2 (y;E), 

0h(x;y)-S 4 (y;E). 1 ' 

The expression for the upper bound on S 2 (y; E) (resp. S^y; E)) is computed from the 
symplectic eigenvalues u%, v 2 of I^ (resp. r±) and from the eigenvalue z/3 of the matrix 
phom ( reS p phom Qr -phet d e p en di n g on the nature of the measurement ) corresponding 

to the covariance matrix of Alice's state given the result y of Bob's homodyne (or 
heterodyne) measurement [8]. 

We computed in the previous sections the covariance matrix of the bipartite state 
prepared by Alice, that is, before the quantum channel. In order to bound Eve's 
information, we need to know the covariance matrix r 2j 4 of the state shared by Alice 
and Bob, that is, after the quantum channel. 

In this paper, we make the assumption that the quantum channel is linear (see 



Appendix A for details). In that case, one can easily use standard techniques from 



statistics (see Ref. |29j) in order to estimate its transmission T and excess noise £. 
The covariance matrix T 2 4 of the state shared by Alice and Bob is given by: 



2,4 



{V A + 1)1 2 VTZ 2A a z 
VTZ 2A a z {TV A + l + Ti)l 2 



(53) 



The reduced covariance matrix given Bob's measurement result depends on the type of 
measurement performed, either homodyne or heterodyne: 

/ T/„ _|_ 1 _ ( z 2a) 2 n \ 

phom / TVa + 1+T£, U C54) 

1 V A + 1 
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and 

4 ~\ + (55) 

Let us now explain how these covariance matrices can be estimated from 
experimental data. Indeed, one should recall that these covariance matrices correspond 
to a virtual bipartite state, namely the state that Alice and Bob would share in 
the entanglement-based version of the protocol. Therefore, they cannot be measured 
directly. Let us note x and y the respective random variables corresponding to Alice 
and Bob's classical data in the prepare and measure scenario. One can show that the 
covariance matrices above can be derived from the observed second moments of the 
variables x and y, that is (x 2 ), (xy) and (y 2 ). One has: Va = (x 2 ), T = and 
TV A + 2 + T£ = (y 2 ). 

This shows that the covariance matrices in the entanglement-based scenario are 
indeed accessible from the experimental data in the actual prepare and measure protocol, 
assuming that the quantum channel is linear. 

7. Theoretical performances 

First, it is worth mentioning that the bounds for the Holevo information S(y; E) that 
we derive from the covariance matrices of |$2) and ($4) are not proven to be tight. 
Indeed, even in the case where the quantum channel between Alice and Bob is perfect, 
that is, T = 1 and £ = 0, the bounds we compute do not give S(b; E) = as we 
would expect, except in the limit of infinitely small modulation variances a — > 0. This 
is because the states |$2) and [$4) are not Gaussian. However, the approximation 
becomes reasonably good for low modulation variances and one can expect the bounds 
not to be too loose. An intriguing question is whether the value of S(y; E) computed 
for the Gaussian protocol is an upper bound for the same quantity computed for the 
discrete-modulation protocols. With the proof we presented, this is not the case (for 
instance, for a perfect quantum channel, Sa(y] E) = as expected, whereas the bounds 
we found for S 2 (y; E) and S^y^E) are positive). It is quite natural to expect the 
following relation to hold 5*2(1/; E), S^y; E) < Sc(y', E) since a discrete modulation 
never maximizes the mutual information between Alice and Bob, and it is doubtful that 
it presents any advantage for a eavesdropper. However, our security proof cannot bring 
a definitive answer to this question. 

The performances of the two-state protocol are displayed on Figure [5] corresponding 
to a realistic scheme where the reconciliation efficiency is only 80% and the quantum 
efficiency of Bob's detector is equal to 60% (these values are compatible with state-of- 
the-art experimental implementations [9]). One can see from Figure |5]that the two-state 
protocol can only work in a regime where the excess noise is very small: around 1/1000. 
We note that this result is compatible with the results obtained in [22] where the authors 
study the security of a slightly different version of the two-state protocol, where they 




Figure 5. (Color online.) Secret key rate K of the two-state protocol for a imperfect, 
realistic reconciliation efficiency of 80% and a quantum efficiency of Bob's detection 
equal to 0.6. From top to bottom, excess noise is 0.001, 0.0015, 0.002. The respective 
optimized modulation variances (in number of photons) are 0.015, 0.018 and 0.23. 



need to assume the perfect knowledge of the probability distribution p(y\x) of Bob's 
measurements results given Alice's results. 

The performance of the four-state protocol with a homodyne detection is presented 
on Figure [6] for an realistic reconciliation efficiency of 80% as well as a realistic quantum 
efficiency of 60% for Bob's detector (which is treated as part of the overall loss between 
Alice and Bob). The performance of the protocol with a heterodyne detection is 
displayed on Figure [7| One immediately notices that the four-state protocol performs 
much better than its two-state counterpart, that is, it allows for a distribution of secret 
keys over longer distances, and tolerates a much higher (and more reasonable) excess 
noise. Note that choosing a homodyne or a heterodyne detection does not sensibly affect 
the performances of the protocol. The better resistance to excess noise of these protocols 
is extremely important because the results presented so far are a little too optimistic, 
in the sense that they assume a perfect knowledge of the transmission and excess 
noise (which is already infinitely less demanding that requiring a perfect knowledge 
of the quantum channel, which is described by an infinite number of parameters). In 
practice, however, these parameters can never be perfectly known, and they can only 
be estimated with a precision depending on the number N — n of data used in the 
parameter estimation. The main consequence of this imperfect parameter estimation 
is to increase the effective excess noise, thus decreasing the actual performance of the 
protocols. The finite size effects for CV QKD protocols are investigated elsewhere [29J. 

8. Conclusion 

We introduced continuous-variable quantum key distribution protocols displaying a 
discrete modulation. We consider the cases of two and four state modulation. We 




Figure 6. (Color online.) Secret key rate K of the four-state protocol with a 
homodyne detection for a imperfect, realistic reconciliation efficiency of 80% and a 
quantum efficiency of Bob's detection equal to 0.6. From top to bottom, excess noise 
is 0.002, 0.004, 0.006, 0.008 and 0.01. The modulation variance (in number of photons) 
is 0.125, that is V A = 0.25. 




Figure 7. (Color online.) Secret key rate K of the four-state protocol with a 
heterodyne detection for a imperfect, realistic reconciliation efficiency of 80% and a 
quantum efficiency of Bob's detection equal to 0.6. From top to bottom, excess noise is 
0.002, 0.004, 0.006, 0.008 and 0.01. The modulation variance (in number of photons) 
is 0.125, that is V A = 0.25. 



established the security of these protocols against collective attacks for which the 
quantum channel is linear. As expected, the four-state protocol clearly outperforms the 
two-state protocol. The generalization to modulation schemes with a higher number of 
states may be considered, but it is not so straightforward as one would lose the main 
advantage of the protocols presented here, that is, their very efficient reconciliation 
procedure. However, if one allows for a heterodyne detection instead of a homodyne 
detection, new continuous modulation schemes can lead to better performances [31]. 
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An important question at that stage is how to avoid the extra hypothesis that the 
channel should be linear. As shown in Ref. [32], this can be done by using decoy states, 
in order to embed the non-Gaussian modulation into an overall gaussian modulation. 
It is then safe to evaluate the values of T and £ from a gaussian probe beam, and then 
to use them as described in the present paper. 
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Appendix A. Linear quantum channels 

We shall define a linear quantum channel by the input-output relations of the quadrature 
operators in Heisenberg representation : 

X out = gxX in + Bx 

Pout = g P Pin + Bp (A.l) 

where the added noises B x , B P are uncorrelated with the input quadratures X in , P in . 
Such relations have been extensively used for instance in the context of Quantum Non- 
Demolition (QND) measurements of continuous variables |30j, and they are closely 
related to the linearized approximation commonly used in quantum optics. Gaussian 
channels (channels that preserve the Gaussianity of the states) are usual examples of 
linear quantum channels. However, linear quantum channels may also be non-Gaussian, 
this will be the case for instance if the added noises Bx, Bp are non-Gaussian. 

For our purpose, the main advantage of a linear quantum channel is that it will be 
characterized by transmission coefficients Tx = g\, Tp = gp, and by the variances of the 
added noises Bx and Bp. These quantities can be determined even if the modulation 
used by Alice is non-Gaussian, with the same measured values as when the modulation 
is Gaussian (because these values are intrinsic properties of the channel). The relevant 
covariance matrix can then be easily determined, and Eve's information can be bounded 
by using the Gaussian optimality theorem. 

Appendix B. Reconciliation at very low SNR 

As we explained, the main reason a Gaussian modulation does no allow for key 
distribution over very long distances because reconciliation of correlated Gaussian 
variables is quite complicated at low SNR, and the present techniques are not efficient 
in this regime. The main interest of the discrete modulations presented here is that 
the reconciliation consists in a channel coding problem for the BI-AWGN channel, 
which turns out to have efficient solutions. In this appendix, we describe in detail 
this reconciliation procedure. 
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For both modulation schemes, Bob will "see" an effective BI-AWGN channel for 
either choice of quadrature. Assuming that the quantum channel is known and is indeed 
Gaussian (which is the case in actual experiments), Alice and Bob can model their 
classical data respectively as x = (xi, ■ ■ • , x n ) (with Xi = ±a/\/2) and y = [y\ 1 • • • , y n ) 
(here we only consider the data which are used to distill the key, that is, we assume 
that the parameter estimation was already performed. We also assumed that Bob 
has informed Alice of his choice of quadrature in the four-state protocol. Therefore, 
yi corresponds to Bob's measurement result for the signal i (normalized with the 
transmission) and x^ corresponds to the corresponding quadrature for Alice's state. 
The Gaussian channel model reads: 

yi = Xi + Zi, (B.l) 

where Zi is a normal random variable with known variance a 2 and Xi is simply an 
unbiased Bernoulli random variable (that we can assume takes values +1 or —1 up to a 
simple renormalisation). With these notations, the SNR is given by: 

SNR= \, (B.2) 

and we would like to find reconciliation scheme that perform well, say /3 = 80%, for very 
small values of the SNR, for instance 1/100, or even less. 

Appendix B.l. Good low rate error correcting codes. 

First of all, the reconciliation procedure is necessarily based on good error correcting 
codes, such as low-density parity-check (LDPC) codes [33]. Despite their great 
performances, LDPC codes are not universal in the sense that they have not been 
optimized for every channel. For instance, they perform very well for the BI-AWGN 
channel when their rate is at least 0.2. 

A special kind of LDPC codes was recently developed to work at reasonably low 
SNR: the multi-edge type LDPC codes [51) . Such codes display good performances for 
rates as low as 1/10. Even if they help working at low SNR, these codes do not solve 
our problem completely as we would like codes working at much lower rates. What rate 
do we need exactly? The rate R is linked to the reconciliation efficiency through 

P = T^—, (B.3) 

^ Gauss 

where 

CGauss = ^l0g 2 (l + S ) (B.4) 

is the capacity of the AWGN channel (which is achieved with a Gaussian modulation) 
and s is the SNR. Since in our protocol, we are restricted to a binary modulation, this 
capacity cannot be reached, and the maximal value of the mutual information between 
Alice and Bob is given by the capacity of the BI-AWGN channel, Cbi-awgn(s): 

Cbi-awgn(s) = - / <p s {x) \og 2 ((j) s (x))dx - - log 2 (2vre) + - log 2 (s) (B.5) 



Continuous-variable Quantum Key Distribution protocols with a discrete modulation 18 



where 




»(x+l) 2 /2 + e - 8 (x-l) a /2 



(B.6) 



Quite interestingly, for small values of the SNR, both quantities Ccauss an d Cbi_awgn 



are almost equal as can be seen on Figure Bl However, the two quantities are obviously 
quite different for large SNR as the Gaussian capacity is unbounded whereas the capacity 
for a binary modulation is upper bounded by 1: one cannot send more than one bit of 
information per channel use with a binary modulation. With these notations, one can 
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Figure Bl. Channel capacities for an AWGN channel with a Gaussian modulation 
(upper curves) and a binary modulation (lower curves) as a function of the signal-to- 
noise ratio 



rewrite the reconciliation efficiency as 

R 



a = a 



modulation 



BI— AWGN 



where 



a 



Gauss 



modulation 



(B.7) 



(B.8) 



Cbi-awgn 

is a factor that rapidly tends to 1 as the signal-to-noise ratio tends to 0, and the second 
term .R/Cbi-awgn directly reflects the performance of a given code of rate R on the BI- 
AWGN channel. In the limit of low SNR, we can approximate /^modulation ~ 1, meaning 
that the code rate that we require is given as a function of the SNR s by 

I 
2 

log 2 e 



R(s) 



log 2 (l + s) 

'"-/3 s. 



(B.9) 
(B.10) 



Since we want to fix the value of the reconciliation efficiency (for instance to 80%), we 
see that we need to find error correcting codes with a rate proportional to the signal- 
to-noise ratio. Hence, we would like to have a process such that if we know a code with 
rate R and efficiency /3 for a SNR s, we can construct a code with rate R = R/k (for 
some integer k > 2) which achieves an efficiency /3' close to /3 at a SNR s' = s/k. This 
can be done quite simply with the idea of repetition code. Let us indeed consider the 
following scenario: instead of sending a random Xj = ±1 for each use of the channel, 
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Alice sends k times the same value, that is, x^ — Xi 2 — ■ ■ ■ — Xi k = Aj. Hence Bob 
receives k noisy versions of Xf. 

Vh = x h + z h (B.ll) 
Vh = x h + z h (B.12) 
•••=••• (B.13) 

Vik = x ik+ z i k i ( B - 14 ) 
where Zi x , Zi 2 , ■ ■ ■ , z.i k are k independent and identically distributed random variables: 
Z{. ~ A/"(0, a 2 ) for j e {1, • • • , k}. Let us now consider the new random variables defined 
as: 

.j k ^ k ^ k 

j=l j=l j=l 

One has 

Yi = Xi + Z h (B.16) 

with Xi = ±1, and Z ri ~ A/"(0, ^). The new channel with input Xi and output Yi is 
therefore also a BI-AWGN channel but with a signal-to-noise ratio k times higher than 
for the initial channel. Hence, if one knows a code with rate R achieving a reconciliation 
efficiency f3(s) for a BI-AWGN channel with SNR s, one can use a repetition scheme 
length k to build a code of rate R' = R/k achieving a reconciliation efficiency f3'(s/k) 
for a SNR s' = s/k. The new reconciliation efficiency (3'{s/k) is given by 

(3'{s/k) = P(s) - J Qg2 i 1 + g) /M . (B.17) 
HK k log 2 (l + s/k) 

For small values of s, this gives (3' (s/k) w as expected. Unfortunately, as we said 
before, good codes are not known for very small values of s, and the best low rate codes 
presently available are the multi-edge type LDPC codes. In particular, the code of rate 
1/10 described in [31] manages to decode reasonably well for a SNR of 0.17. This means 



that this code is such that /3(0.17) ~ 88%. Using equation B.17, one observes that for 
all k > 1, (3'(0.l7/k) > 80%. Hence, we can construct codes with arbitrarily low rate 
that have a reconciliation efficiency greater that 80%. We plot the performance of such 



codes on Figure B2 where we compare it with the reconciliation efficiency achieved with 
a Gaussian modulation. The difference is striking for low SNR: our concatenation of 
repetition codes with multi-edge type LDPC codes has a reconciliation efficiency alway 
greater than 80% when the SNR tends to zero, whereas the reconciliation efficiency is 
good (in the sense that in can be used in a CV QKD protocol) only for large enough 
SNR. 



Appendix B.2. Specificities of the reverse reconciliation. 

Until now, we described a generic method to achieve a good reconciliation efficiency 
on channels with arbitrarily low SNR. Unfortunately, the approach we described is not 
directly compatible with QKD. The reason for this is two-fold: 
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Figure B2. (Color online) Practical reconciliation efficiency for a binary modulation 
(dashed line) and for a Gaussian modulation (full line) |26| . 



• first, Alice cannot choose to send k times in a row the same quantum state, as this 
might give some information to the eavesdropper, 

• but, more importantly, continuous- variable QKD uses reverse reconciliation, 
meaning that Alice needs to guess Bob's measurement result, and not the other way 
around which would correspond to a direct reconciliation scheme. The problem here 
is that Bob cannot decide to measure k times in a row the same value. Moreover, it 
is not completely clear that the channel corresponding to the reverse reconciliation 
procedure is a BI-AWGN channel as well. We now answer these two points. 



Appendix B.3. The reverse reconciliation channel. 

As we said, whereas the direct reconciliation channel is a BI-AWGN channel: 

input : x = ±1 — > output : y = x + z with z ~ A/"(0, a 2 ), (B.18) 

it is not clear what the reverse reconciliation channel is, simply because its input in real- 
valued (instead of binary), and that its output is binary instead of being real- valued! In 
fact, it turns out that this reverse reconciliation channel can be transformed into a BI- 
AWGN channel, if Bob sends some side-information to Alice. Our goal is to define two 
variables u for Bob and v for Alice such that the channel mapping u to v is a BI-AWGN 
channel. This can be done through the following procedure. First Bob computes two 
values u and the side-information t from his variable y. These two numbers are defined 
as 



u = y/\y\ 
t = \y\ 



(B.19) 



Note that for an AWGN channel, the variables u and t are independent: the sign of y is 
independent from its absolute value since the distribution of y is symmetric. One can 
also note that u is a unbiased Bernoulli random variable, and therefore corresponds to 
a legitimate input for a BI-AWGN channel. Now, t is considered as a side-information 
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and is sent by Bob to Alice, who can use it to compute a random variable v defined as 

J * 

One can check that u and v are related through 

v = u + w, (B.21) 

where 

w = v-u (B.22) 

= sga(x)\y\ -sgn(y) (B.23) 

= sgn(y) (sgn(x)y - 1) (B.24) 

= sgn(y)(sgm>)(:r + z)-l) (B.25) 

= sgn(y) (1 + sgn(x) z - 1) (B.26) 

= sgn(xy) z (B.27) 

which means that w ~ A/"(0, a 2 ) since Prob(sgn(xy) = 1) = Prob(sgn(a;y) = —1) = 1/2. 
Hence, the channel corresponding to the reverse reconciliation scenario, taking u as 
input and v as output is a BI-AWGN channel. 

Let us now show how one can apply the repetition trick to this channel. The main 
problem now is that one would want to be equal to tij 2 , • • • , Ui k . Obviously, there 
is only one chance over 2 h ~ 1 for this to happen. The way to overcome this difficulty 
is in fact quite simple. In the direct reconciliation protocol, Bob would need to guess 
whether (x^, ■ ■ ■ , Xi k ) equals (1, • • • , 1) or (— 1, • • • , — 1). In the reverse reconciliation 
protocol, Bob will inform Alice of the signs of y% 2 , - ■ ■ , Vi k relatively to the sign of 
yi 1 (which therefore encode the relevant information), that is, Bob will give Alice the 
following (k — 1) values: sgn^^y^), • • • , sga(y il y ik ) . Hence, in the reverse reconciliation 
protocol, Alice needs to guess whether (y h , ■ ■ ■ , y ik ) equals (1, y h y i2 , ■ ■ ■ , y^yi k ) or 
(— (1, —y^y^, • • • , —y^yij. Clearly, this problem is completely equivalent to the direct 
reconciliation case. In fact, this solution exactly corresponds to Bob informing Alice of 
the syndrome of his bit string relative to the repetition code of length k. 

To summarize, the reconciliation procedure starts with Alice and Bob having two 
correlated vectors of length k x m: (xi, ■ ■ ■ , Xkm) and (yi, • • • , yum)- Bob defines the 
vector u = (ui, ■ • ■ ,Wfc m ) and sends some side information to Alice, namely the vector 
t = (ti, • • • , t km ) as well as the m vectors (1, sgn(y ki+1 y ki+2 ), ■■■ , sgn(y ki+1 y ki+k ) so that 
Alice needs to guess the value of the vector U = (sgn(-U!), sgn(w fc+1 ), sgn(w 2 fc+i), • • • , 
sgn(w( m _i)fc + i)), which is a binary vector of length m. To do this, Alice and Bob first 
agree on a particular multi-edge type LPDC code C, and Bob sends the syndrome of U 
relative to C to Alice. Alice simply proceeds by decoding C in the coset code defined 
by the syndrome in question, and recovers U. 

To conclude, it is easy to adapt the error correction scheme to a reverse 
reconciliation procedure: it simply involves for Bob to send some well-chosen side- 
information to Alice through the authenticated classical channel. An important remark 
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is that the role of the side-information is to help Alice to increase the speed and efficiency 
of the error correction procedure. The eavesdropper, on the other hand, is supposed to 
have perfect error correction available and cannot benefit of this side-information as long 
as it is independent of the key. To see this, let us introduce some additional notations: 
let synd be the syndrome information that Bob sends to Alice and |y| be the vector 
corresponding to the absolute value of the vector y. The syndrome synd defines a coset 
code C for which the word U is a codeword. Let RK be the index of this codeword: 
this corresponds to the raw key that Alice and Bob will use for privacy amplification. 
We want to bound Eve's knowledge on RK given that she has access to the value of 
synd and |y|. Using Lemma 1 of Ref. [TJ] and the fact that RK is independent of both 
synd and |y|, one obtains: 

S(RK;(E,synd,\y\)) < S(RK, synd, \y\;E), (B.28) 

that is S(RK; (E, synd, |y|)) < S(y; E) which means that the reconciliation procedure 
does not give any information to Eve about the raw key RK. 

The repetition scheme presented above provides a simple method to build a good 
code of rate R/k out of a code of rate R. This construction is not optimal compared 
to using a very good error correcting code at the considered signal-to-noise ratio but 
exhibits some interesting features. First, designing very good codes at low SNR is not 
easy, and has not been intensively studied so far, mainly because the telecom industry 
does not operate in this regime: this would not be economical since an important 
number of physical signals would be required to send one information bit. The problem 
is very different in QKD, where quantum noise is an advantage rather than a drawback. 
A second advantage of this repetition scheme lies in its simplicity. As we mentioned 
earlier, the main bottleneck of CV QKD is the reconciliation : it used to limit both the 
range and the rate of the protocol. In particular, the rate is limited by the complexity of 
decoding LDPC codes, which is roughly proportional to the size of the code considered 
(in fact 0(N log N)). If one uses a repetition scheme of length k, then the length of the 
genuine LDPC code becomes m = N/k allowing a speedup of a factor k. The speed of 
the reconciliation is not proportional to the number of signals exchanged by Alice and 
Bob anymore, but to the mutual information they share, which is a major improvement 
for noisy channels, i.e., long distance. Finally, the penalty in terms of reconciliation 
efficiency imposed by using this scheme instead of a dedicated low rate error correcting 
code is actually quite small, as soon as one knows a good low rate code. As we saw, a 
multi-edge type code of rate 1/10 is sufficient for our purpose. 
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